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IN THE CLAIMS 
Amended claims follow: 

1 . (Currently Amended) A method for protecting a computer in an opened share 
mode, comprising: 

(a) running a computer on a network in an opened share niode,_\vherein the 
opened share mode indicates a file structure parameter a nd a name parameter 
and applies onlv to a manually selected list of at least one o f application 
programs and data ; 

(b) monitoring attempts to access the computer by applications utilizing the 
network, usin^ the file structure and name parameter : 

(c) determining whether the applications attempt to modify the computer; and 

(d) executing a security event in response to any attempt to modify the 
computer. 

2. (Original) The method as recited in claim 1, wherein the opened share mode 
allows other computers on the network to access data stored on the computer. 

3. (Original) The method as recited in claim 1 , wherein the opened share mode 
includes a virtual opened share mode, 

4. (Original) The method as recited in claim 3, wherein the virtual opened share 
mode indicates to other computers of an ability to write to the computer. 

5. (Original) The method as recited in claim 4, wherein the computer operates 
in the virtual opened share mode by modifying an application program 
interface. 

6. (Original) The method as recited in claim 5. wherein the application program 
interface includes an operating system application program interface. 
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7. (Original) The method as recited in claim 5, wherein the application program 
interface includes a network application program interface. 

8. (Cancelled) 

9. (Original) The method as recited in claim 1 , wherein the opened share mode 
indicates a plurality of parameters that are randomly selected to prevent 
detection, 

1 0. (Original) The method as recited in claim 1 , wherein the opened share mode 
applies to each of a plurality of networks of which the computer is a member. 

11. (Cancelled) 

12. (Cancelled) 

13. (Cancelled) 

14. (Original) The method as recited in claim ], wherein the computer is run on 
the network in a plurality of opened share modes. 

1 5. (Original) The method as recited in claim 1, wherein any attempt to modify 
the computer is utilized in a heuristic analysis for identifying a coordinated 
attack on multiple computers. 

1 6. (Original) The method as recited in claim 1 , wherein attempts to modify the 
computer are tracked. 

17. (Original) The method as recited in claim 1, wherein it is determined whether 
the applications attempt to write to memory in the computer, and the securitj' 
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event is executed in response to any attempt to write to memory in the 
computer. 

1 8. (Original) The method as recited in claim 1 , wherein it is determined whether 
the applications attempt to copy a virus to memory in the computer, and the 
security event is executed in response to any attempt to copy the virus to 
memory in the computer. 

19. (Original) The method as recited in claim 1 , wherein the security event 
includes iogging the computer off the network in response to any attempt to 
modify the computer, 

20. (Original) The method as recited in claim 1 , wherein the security event 
includes terminating the application attempting to modify the computer. 

2 1 . (Original) The method as recited in claim 1 , wherein the security event 
includes deleting the application attempting to modify the computer. 

22. (Original) The method as recited in claim 1 , wherein the security event 
includes an alert transmitted via the network. 

23. (Original) The method as recited in claim 22, wherein the alert includes 
information associated with the application attempting to modify the 
computer. 

24. (Currently Amended) A computer program product for protecting a computer 
in an opened share mode, comprising: 

(a) computer code for running a computer on a network in an opened share 

mode , wherein the opened share mode indicates a file stru cture parameter 
and a name parameter and applies only to a manually se lected list of at least 
one of application programs and data : 
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(b) computer code for monitoring attempts to access the computer by 
applications utilizing the network , using the file structure and name 
parameter ; 

(c) computer code for determining whether the applications attempt to modify 
the computer; and 

(d) computer code for executing a security event in response to any attempt to 
modify the computer. 

25. (Original) The computer program product as recited in claim 24» wherein the 
network includes the Internet, 

26. (Original) The computer program product as recited in claim 24, wherein the 
opened share mode allows other computers on the network to access data 
stored on the computer. 

27. (Original) The computer program product as recited in claim 24, wherein the 
opened share mode includes a virtual opened share mode. 

28. (Original) The computer program product as recited in claim 27, wherein the 
virtual opened share mode indicates to other computers of an ability to write 
to the computer. 

29. (Original) The computer program product as recited in claim 28, wherein the 
computer operates in the virtual opened share mode by modifying an 
application program interface. 

30. (Original) The computer program product as recited in claim 29, wherein the 
application program interlace includes an operating system application 
program interface. 
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31. (Original) The computer program product as recited in claim 30, wherein the 
application program interface includes a network application program 
interface. 

32. (Cancelled) 

33. (Original) The computer program product as recited in claim 24, wherein the 
opened share mode indicates a plurality of parameters that are randomly 
selected to prevent detection. 

34. (Original) The computer program product as recited in claim 24, wherein the 
opened share mode applies to each of a plurality of networks of which the 
computer is a member. 

35. (Cancelled) 

36. (Cancelled) 

37. (Cancelled) 

38. (Original) The computer program product as recited in claim 24, wherein the 
computer is run on the network in a plurality of opened share modes. 

39. (Original) The computer program product as recited in claim 24, wherein any 
attempt to modify the computer is utilized in a heuristic analysis for 
identifying a coordinated attack on multiple computers. 

40. (Original) The computer program product as recited in claim 24, wherein 
attempts to modify the computer are tracked. 
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41 . (Original) The computer program product as recited in claim 24, wherein it is 
determined whether the applications attempt to write to memory in the 
computer, and the security event is executed in response to any attempt to 
write to memory in the computer. 

42. (Original) The computer program product as recited in claim 24, wherein it is 
determined whether the applications attempt to copy a virus to memory in 
the computer, and the security event is executed in response to any attempt to 
copy the virus to memory in the computer. 

43. (Original) The computer program product as recited in claim 24. wherein the 
security event includes logging the computer off the network in response to 
any attempt to modify the computer. 

44. (Original) The computer program product as recited in claim 24, wherein the 
security event includes terminating the application attempting to modify the 
computer. 

45. (Original) The computer program product as recited in claim 24, wherein the 
security event includes deleting the application attempting to modify the 
computer. 

46. (Original) The computer program product as recited in claim 24, wherein the 
security event includes an alert transmitted via the network. 

47. (Original) The computer program product as recited in claim 46, wherein the 
alert includes information associated with the application attempting to 
modify the computer. 

48. (Original) The computer program product as recited in claim 24, wherein at 
least a portion of the computer code resides on a gateway. 
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49. (Original) The computer program product as recited in claim 48, wherein the 
security event includes blocking access to the computer. 

50. {Currently Amended) A system for protecting a computer in an opened share 
mode, comprising: 

(a) logic for running a computer on a network in an opened share mode , wherein 
the opened share mode indicates a File structure parameter and a name 
parameter and applies only to a manually selected list of at least one of 
application programs and data ; 

(b) logic for monitoring attempts to access the computer by applications utilizing 
the network , using the file structure and name parameter ; 

(c) logic for determining whether the applications attempt to modify the 
computer; and 

(d) logic for executing a security event in response to any attempt to modify the 
computer. 

5 1 . (Currently Amended) A method for protecting a computer in an opened share 
mode, comprising: 

(a) running a computer on a network in a virtual opened share mode and an 
actual opened share mode , wherein the virtual opened share mode allows 
other computers on the network to access predetemiined data and programs 
resident on the computer, and indicates to other computers of an ability to 
write to the computer , and the actual opened share mode indicates a file 
structure parameter and a name parameter that are capable of actually being 
accessed bv the other computers, and applies only to a manually selected list 
of at least one of application programs and data ; 

(b) monitoring attempts to access the computer by applications utilizing the 
network , using, at least in part, the file structure and name parameter : 

(c) determining whether the applications attempt to modify the computer; 

(d) tracking the attempts of the applications to modify the computers; 
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(e) transmitting an alert via the network in response to any attempt to modify the 
computer, wherein the alert includes information associated with the 
applications attempting to modify the computer: 

(f) logging the computer off the network in response to any attempt to modify 
the computer; and 

(g) deleting any application attempting to modify the computer; 

(h) wherein any attempt to modify the computer is utilized in a heuristic analysis 
for identifying a coordinated attack on multiple computers* 

(]) wherein fdVfh'^ are carried out if it is determined that the applications 
anempt to modify the computer via the virtual opened share mode: and 
access is permitted if it is determined that the applications attempt to modify 
the computer via the actual opened share mode . 

52. (Currently Amended) A computer program product for protecting a computer 
in an opened share mode, comprising: 

(a) computer code for running a computer on a network in a virtual opened share 
mode and an actual opened share mode , wherein the virtual opened share 
mode allows other computers on the network to access predetermined data 
and programs resident on the computer, and indicates to other computers of 
an ability to write to the compute r, and the actual opened share mode 
indicates a file structure parameter and a name parameter that are capable of 
actually being accessed by the other computers, and applies only to a 
manually selected list of at least one of application programs and data : 

(b) computer code for monitoring attempts to access the computer by 
applications utilizing the network , using, at least in part, the file structure and 
name parameter ; 

(c) computer code for determining whether the applications attempt to modify 
the computer; 

(d) computer code for tracking the attempts of the applications to modify the 
computers; 
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computer code for transmitting an alert via the network in response to any 
attempt to modify the computer, wherein the alert includes information 
associated with the applications attempting to modify the computer; 
computer code for logging the computer off the network in response to any 
attempt to modify the computer; and 

computer code for deleting any application attempting to modify the 
computer; 

wherein any attempt to modify the computer is utilized in a heuristic analysis 
for identifying a coordinated attack on multiple computers: 
wherein rdV(h^ are carried out if it is determined that the ap plications 
attempt to modify the computer via the virtual opened sh are mode: and 
access is permitted if it is determined that the application s attempt to modify 
the computer via the actual opened share mode . 

53. (New) The method as recited in claim 1 , wherein the file structure includes a 
tree structure. 

54. (New) The method as recited in claim 1, wherein the computer is run in an 
actual opened share mode and a virtual opened share mode such that the at 
least one of application programs and data is accessible in the actual opened 
share mode, and attempted access to the at least one of application programs 
and data associated with the virtual opened shared mode prompts a security 
process. 

55. (New) The method as recited in claim 54, wherein the security process 
includes temporarily logging off the nenvork, recording in a record 
information on any attempt to modify the computer including time and 
source information, logging the computer back on the neuvork in a mode 
other than the actual opened share mode, transmitting the information to a 
third party, determining whether a trend is found indicative of a coordinated 
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attack, and sending an alen and logging a culpable computer off the network 
based on the deternnination. 
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